PT-2017-11914 · Imagemagick · Imagemagick

Jgj212 · Published 2017-07-13 · Updated 2019-10-03 · CVE-2017-11310

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions ImageMagick version 7.0.6-1 Q16 2017-06-21 (beta)

Description The issue is related to memory leak vulnerabilities in the read user chunk callback function, located in coderspng.c, which can be exploited via crafted PNG files.

Recommendations For ImageMagick version 7.0.6-1 Q16 2017-06-21 (beta), consider restricting the use of the read user chunk callback function until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Missing Release of Resource after Effective Lifetime

Weakness Enumeration

CWE-772

Related Identifiers

CVE-2017-11310

Affected Products

Imagemagick

References · 5

• https://github.com/ImageMagick/ImageMagick/issues/517 · Patch
• https://github.com/ImageMagick/ImageMagick/commit/8ca35831e91c3db8c6d281d09b605001003bec08 · Patch
• https://osv.dev/vulnerability/CVE-2017-11310 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-11310 · Security Note
• http://securityfocus.com/bid/99585 · Note